It may be hard to believe, but since just last month, states have introduced over 30 new student data privacy bills! That means that as of today, 42 states have introduced 170 student privacy bills. Three states have now signed eight student data privacy bills into law.
Here’s a (very) quick look at each of the new laws:
Arkansas
- HB 1241 prohibits the state from providing access to students’ personally identifiable information (PII) to the US Department of Education or any federal partner (including technical assistance providers and program monitors) without parental consent.
- HB 1961 is based on California’s SOPIPA language from 2014 and prohibits online service providers from using student data for commercial or secondary purposes, while allowing data use for program improvement.
Utah
- HB 68 requires the State Board of Education to make recommendations to the legislature on updating student privacy, security, and data use laws, and requires the state board to designate a chief privacy officer.
- HB 163 requires an education entity to notify parents if there is a release of their student’s PII due to a security breach.
- SB 204allows a parent to opt their child out of any federally or state mandated assessment.
Virginia
- HB 2350 directs the state to develop a model data security plan for districts and to designate a chief data security officer to assist local school divisions with the development or implementation of data use and security policies.
- HB 1334 requires the state to develop policies ensuring state and local compliance with federal and state privacy laws and requires parental notification in instances of possible disclosures of electronic records in violation of the Family Educational Rights and Privacy Act (FERPA).
- HB 1698 requires parental notice and allows opt out of any survey on “sensitive” topics.
These laws cover several different topics ranging from online apps to survey data to local data policies. They also adopt different approaches (sometimes even within the same state!), with some new laws focusing on governing data and others trying to limit the data collected.
Within this diverse array of new laws, two critical themes seem to be on the minds of state legislators: the role of third-party service providers and how to best support and build capacity at the local level. As states and districts increasingly work with service providers to make the most of their education data, states are working to update their laws and policies and ensure their districts have the model policies, leadership, and guidance they need to be successful.
